[USN-7405-1] InspIRCd vulnerabilities

[Bruce Cable]

==========================================================================
Ubuntu Security Notice USN-7405-1
April 02, 2025

inspircd vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in InspIRCd.

Software Description:
- inspircd: Modular IRCd written in C++

Details:

It was discovered that InspIRCd did not correctly handle certificate
fingerprints, which could lead to spoofing. A remote attacker could
possibly use this issue to bypass authentication. This issue only affected
Ubuntu 16.04 LTS. (CVE-2016-7142)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a NULL pointer dereference. A remote
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-20917)

It was discovered that InspIRCd did not correctly handle certain memory
operations, which could lead to a use-after-free. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2020-25269)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   inspircd                        3.4.0-2ubuntu1+esm1
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   inspircd                        2.0.24-1ubuntu1+esm1
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   inspircd                        2.0.20-5ubuntu0.1~esm1
                                   Available with Ubuntu Pro

After a standard system update you need to restart InspIRCd to make
all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7405-1
   CVE-2016-7142, CVE-2019-20917, CVE-2020-25269

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 665 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20250402/8f8325af/attachment.sig>